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PROBABILISTIC  APPROACH  TO  EMP  ASSESSMENT 


/  ABSTRACT 

'"-The  development  of  nuclear  EMP  hardness  requirements  must  account  for 
uncertainties  in  the  environment,  in  interaction  and  coupling,  and  in  the 
susceptibility  of  subsystems  and  components.  Typical  uncertainties  of  the 
last  two  kinds  are  briefly  summarized,  and  an  assessment  methodology  is  out¬ 
lined,  based  on  a  probabilistic  approach  that  encompasses  the  basic  concepts 
of  reliability.  It  is  suggested  that  statements  of  survivability  be  made 
compatible  with  system  reliability.  Validation  of  the  approach  taken  for 
simple  antenna/circuit  systems  is  performed  with  experiments  and  calculations 
that  involve  a  Transient  Electromagnetic  Range,  numerical  antenna  modeling, 
separate  device  failure  data,  and  a  failure  analysis  computer  program. 

I 

1.0  INTRODUCTION 

The  development  of  nuclear  electromagnetic  pulse  (EMP)  hardness  require¬ 
ments  and  the  specification  of  EMP  hardening  or  protection  for  a  system  must 
account  for  uncertainties  in  all  areas  from  the  EMP  environment  to  system 
behavior.  For  example,  uncertainties  exist  in  statements  about  the  environ¬ 
ment,  particularly  how  this  environment  interacts  with  and  propagates  through¬ 
out  the  system.  Similarly,  there  are  fundamental  uncertainties  in  the  compon¬ 
ents,  units,  and  subsystems  that  are  to  be  subjected  to  those  uncertain  envi¬ 
ronments.  Uncertainties  appear  in  the  form  of  random  variations,  systematic 
errors,  and  judgmental  factors.  This  paper  briefly  reviews  some  of  the  uncer¬ 
tainties  in  the  areas  of  interaction  and  coupling,  and  susceptibility,  and  it 
suggests  in  some  detail  an  approach  that  can  deal  with  such  uncertainties  in 
assessing  a  system  for  hardness  specification.  This  is  by  no  means  a  complete 
review,  but  we  obtained  information  on  some  major  programs  from  the  EMP  Lead 
Laboratories  of  the  Services  and  from  some  of  their  contractors.  The  suggested 
approach  is  probabilistic  in  nature  and  encompasses  the  basic  concepts  of 
reliability  in  making  statements  concerning  hardness  and  survivability. 
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2.0  GENERAL  NATURE  OF  UNCERTAINTIES 


Uncertainties  arise  in  all  phases  of  vulnerability  assessment  analysis, 
due  to  model  inadequacies,  testing  uncertainties,  lack  of  complete  knowledge 
of  system  parameters,  etc.  These  uncertainties  must  be  accommodated  in  any 
analysis,  whether  it  be  a  deterministic  worst-case  analysis  or  a  probabilistic 
analysis  where  the  uncertainties  are  considered  to  be  nondeterministic. 

In  risk  assessment  programs,  uncertainties  are  classified  into  several 
types.  For  vulnerability  assessment,  three  types  of  uncertainties— random, 
systematic,  and  judgmental— can  be  defined.  Although  there  is  no  universal 
agreement  on  the  definitions  of  these  terms  or  even  for  the  need  to  differ¬ 
entiate  among  different  types  of  uncertainty,  it  is  frequently  interesting  and 
important  to  distinguish  between  uncertainties.  In  particular,  it  may  be  of 
interest  to  separate  the  effect  of  uncertainties  due  to  "inherent"  random 
variation  in  the  properties  of  the  system  from  the  effect  of  those  in  the 
analysis  techniques.  The  latter  can  sometimes  be  reduced  by  improved  tech¬ 
niques,  whereas  the  former  cannot.  Below  we  suggest  a  use  of  terms  that  would 
be  appropriate  for  vulnerability  assessment. 

2.1  RANDOM  UNCERTAINTIES 

Random  uncertainties  are  variations  in  measured  response  due  to  inherent 
natural  variations  in  the  physical  properties,  operation,  or  behavior  of  a 
physical  entity.  Thus,  the  variation  in  the  susceptibility  (response  level  at 
which  failure  occurs)  of  like  components  is  considered  a  random  variation 
(uncertainty).  This  variation  has  many  causes,  such  as  manufacturing  varia¬ 
tion,  variations  in  the  basic  elements  within  the  component,  etc.,  and  it 
includes  measurement  variation.  Similarly,  random  variation  in  an  incident 
electric  field  can  be  due  to  environmental  variation,  random  variation  in  the 
source,  directional  variations,  etc.  All  of  these  variations  are  outside  the 
direct  control  of  the  analyst  and  will  always  be  a  source  of  uncertainty  in 
the  analysis. 


2.2  SYSTEMATIC  UNCERTAINTIES 


Systematic  uncertainties  are  variations  in  response  due  to  imperfect 
modeling,  testing,  design,  analysis,  etc.  The  variation  introduced  into  the 
analysis  by  modeling  (analysis,  computer-  or  scale-model  testing)  introduces  a 
constant,  although  unknown,  uncertainty  in  response.  (For  example,  any  mathe¬ 
matical  model  of  coupling  is  only  an  approximation  to  the  real  system.)  This 
constant  uncertainty  in  the  response  exists  as  long  as  the  model  is  used  in 
the  vulnerability  assessment  analysis. 

2.3  JUDGMENTAL  UNCERTAINTIES 

Judgmental  uncertainties  are  variations  in  response  introduced  by  using 
subjective  opinions  about  unknown  parameters.  Frequently,  many  of  the  param¬ 
eters  in  a  vulnerabi 1 ity  assessment  are  unknown  and  unobtainable.  Thus,  it  is 
necessary  to  depend  on  the  judgment  of  experts  for  the  likely  values  of  the 
parameters.  Anyone  who  makes  such  a  judgment  will  be  doing  so  without  complete 
knowledge,  thus  introducing  uncertainty  into  the  assessment.  For  example  a 
vulnerability  assessment  of  a  system  must  account  for  the  environment.  Since 
it  is  impossible  to  know  all  details  about  the  environment  some  judgments  must 
be  made.  Although  judgmental  uncertainty  influences  the  analysis  in  much  the 
same  way  as  a  systematic  uncertainty,  a  separation  of  the  uncertainty  due  to 
modeling,  testing,  etc.,  from  that  introduced  by  subjective  judgments  is 
clearly  advisable  in  most  situations. 

3.0  UNCERTAINTIES  IN  COUPLING  AND  SUSCEPTIBILITY 

3.1  INTERACTION  AND  COUPLING 

3.1.1  Nature  of  Uncertainties 

Vulnerability  assessment  includes  the  evaluation  of  EMP-induced  currents 
on  conductors  that  might  direct  the  energy  to  susceptible  circuitry.  Various 
approacnes  are  used  to  evaluate  these  currents,  the  most  popular  of  which  are 
full-scale  simulation  tests,  computer  simulations,  and  scale-model  tests  sup¬ 
plemented  with  analysis.  Another  alternative  to  full-scale  testing  is  the 
technique  of  "current  injection"  at  certain  points  of  the  system.  A  fifth 
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method  of  assessment  is  the  evaluation  of  the  EMP  response  of  a  similar,  often 
simpler,  system.  (The  Lawrence  Livermore  National  Laboratory  (LLNL)  has 
published  a  set  of  data  on  external  coupling  of  EMPs  to  generic  structures.^ 
These  data  provide  estimates  of  EMP-induced  current  levels.)  In  several  asses¬ 
sment  efforts,  more  than  one  technique  has  been  used. 

In  the  absence  of  coupling  data  from  actual  high-altitude  nuclear  bursts, 
heavy  reliance  is  placed  on  data  generated  from  full-scale  simulation  tests. 
Such  tests  have  also  been  used  to  validate  other  simulation  techniques. 

However,  full-scale  simulation  tests  are  in  themselves  prone  to  uncertainties, 
which  are  reviewed  and  discussed  below.  There  is  a  large  amount  of  data  on 
simulators  and  on  the  taking  and  processing  of  data  from  them. 

The  nature  of  the  source  of  interaction  and  coupling  uncertainties  are 
closely  connected  to  the  type  of  system  being  evaluated.  For  example.  Army 
communication  equipment  can  be  tested  in  a  HEMP  (high-altitude  electromagnetic 
pulse)  environment  similar  to  that  anticipated  in  field  use,  with  the  possible 
exception  of  very  long  lines  connected  to  the  equipment.  In  contrast,  most 
aircraft  and  missile  tests  are  conducted  on  the  ground  while  attempting  to 
simulate  the  vehicle  in  a  flight  condition.  Problems  of  extrapolating  the  test 
data  to  the  desired  operational  case  is  less  severe  when  the  system  is  more 
closely  simulated  in  both  its  physical  configuration  and  general  operating 
environment. 

Important  coupling  paths  for  Army  ground  communication  equipment  are  from 
the  external  field  to  cables  and  antennas,  and  from  these  to  the  internal 
equipment.  For  aircraft  and  missiles,  the  EMP-induced  effects  enter  the 
system  through  various  ooints-of-entry  (POE),  such  as  apertures  and  external 
antenna  systems.  The  aircraft,  however,  is  still  a  localized  system,  whereas 
cables  of  communication  systems  may  run  for  kilometers. 

The  coupling  assessment  of  aircraft  has  relied  more  heavily  on  system- 
level  simulation  tests  than  on  less  successful  analytical  and  computer  simula¬ 
tion  techniques.  On  the  other  hand,  the  computer  simulation  approach  has  been 
more  successful  for  Army  communication  equipment.  Various  codes  have  been 
developed  and  validated  with  simulation  tests  in  well-controlled  configura¬ 
tions,  then  used  to  predict  currents  on  long  cable  runs  where  simulator  tests 
are  not  feasible. 
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The  Navy  has  also  performed  many  coupling  assessments  on  various  ships, 
using  tne  EMPRESS  EMP-simulation  facility.  Trie  EM P  fields  couple  to  tne 
various  antenna  systems  and  cables  aDoard  the  ships,  which  in  turn  propagate 
the  energy  conductively  through  apertures  to  susceptiule  circuitry  witnin  the 
hull  of  the  ship.  The  direct  coupling  of  the  EMP  fields  to  internal  caoles  is 
minimal,  in  contrast  to  aircraft  coupling  inodes.  1'his  property  of  ships  makes 
scale-model  testing  for  evaluation  of  coupling  an  attractive  alternative  to 
full-scale  ship  simulation  tests. 

Solution  of  the  coupling  problem  Dy  computer  metnods  is  also  attractive 
because  of  the  availability  of  many  efficient  numerical  techniques  and 
computer  programs.  However,  tne  greatest  accuracy  has  been  oDtained  in  the 
prediction  of  external  coupling  levels,  such  as  coupling  to  external  antennas 
(free  space  and  lossy  ground)  and  to  tne  external  conducting  surface  of  an 
aircraft  or  missile.  For  external  coupling,  much  validation  work  has  oeen 
performed,  so  tnat  tne  numerical  modeling  techniques  can  be  used  with  high 
confidence.  There  has  apparently  been  only  limited  success  in  the  prediction 
of  internal  caole  currents,  particularly  the  EMP-induced  currents  in  indivi¬ 
dual  wires.  Very  extensive  and  complete  descriptive  information  is  needed, 
unless  the  configurations  are  quite  simple.  Internal  coupling  estimations 
have  been  attempted  for  complicated  systems  (aircraft  and  ships),  and  aircraft 
predictions  have  been  validated. 

Scale-model  tests  have  been  used  quite  extensively  for  external  coupling 
predictions,  and  this  technique  has  been  validated.  Recently,  the  scale-model 
approach  has  also  been  used  for  making  some  internal  coupling  predictions  for 
a  ship,  and  the  results  indicate  much  promise  for  this  approach,  Duch  scale- 
model  tests  should  be  quite  successful  and  accurate  as  long  as  geometrically 
small  details  in  the  full-scale  system  can  be  neglected.  This  implies  that 
very  small  apertures  cannot  be  allowed  to  become  major  POE  for  energy  into  the 
interior  of  the  ship.  For  this  reason,  the  technique  should  oe  quite  useful 
for  ships,  but  less  useful  for  aircraft.  However,  scale-model  tests  are  useful 
to  predict  external  coupling  to  the  aircraft. 

vde  do  not  wish  to  imply  here  that  one  and  one  only  coupling  technique  has 
been  used  for  each  system.  This  discussion  refers  only  to  the  more  common 
methodology  used.  Coupling  data  for  aircraft  for  instar. re  have  Deen  generated 
by  computer  simulation  when  such  data  were  not  available  or  were  difficult  to 
obtain  with  system  simulation  tests.  An  example  might  be  an  aircraft  with  a 
long,  trailing  wire  antenna. 
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In  this  section,  we  review  typical  uncertainties  in  the  various  coupling 
assessment  techniques.  We  place  emphasis  on  "reasonaole  and  achievable"  accur¬ 
acies,  based  on  well-run  tests  or  analyses.  The  emphasis  is  on  uncertainties 
in  amplitude  in  the  time  domain,  since  electronic  vulnerability  is  usually  much 
more  sensitive  to  changes  in  amplitude  than  to  small  changes  in  frequency 
content. 

A.  Full-Scale  System  Tests.  The  uncertainties  in  full-scale  tests  include 
measurement  errors,  extrapolations  of  test  data,  and  intrasystem  and 
intersystem  variations. 

Measurement  U  :ertainties.  These  include  simulation  variation  errors 
(from  shot-to-shot) ,  instrumentation  errors,  and  data  processing  errors. 

Simulator  field  errors  appear  to  be  primarily  due  to  shot-to-shot  varia¬ 
tions  in  the  discharge  circuits,  waveform  variations,  and  variations  in  non- 
2  3 

principal  (1/R  -1/R  )  components.  The  last  two  appear  to  be  minor.  Exam¬ 
ination  of  a  dozen  or  so  simulators  suggests  that  a  reasonable  and  achievable 
error  due  to  simulator  field  uncertainty  is  +2  dB. 

Instrumentation  errors  include  those  in  current  and  charge  sensors; 
circuit  elements  such  as  caoles,  alternators,  and  power  dividers;  integrators 
and  differentiators;  oscilloscopes;  records;  and  such  subsystems  as  microwave 
telemetry,  screenboxes,  ADSET  data  acquisition,  and  a  similar  DASET  system. 

A  well-controlled  and  calibrated  instrumentation  system  has  about  the 
smallest  error  and  uncertainty  of  any  aspect  of  a  coupling  assessment,  accord¬ 
ing  to  studies  by  several  companies.  For  example,  sensor  errors  can  be  held 
to  1  dB,  as  can  integrator  and  differentiator  errors  up  to  50  MHz;  scope  errors 
can  be  made  almost  negligible.  A  good  microwave  telemetry  or  screenbox  system 
will  have  less  than  1  dB  error  over  its  dynamic  range;  an  ADSET  or  DASET  data 
acquisition  system  can  be  similarly  designed.  An  overall  error  of  +3  dB  is 
reasonable  for  an  entire  instrumentation  system. 

Data  processing  errors  can  occur  during  the  manipulations  of  the  recorded 
raw  data  (digitization,  Fourier  transformation,  etc.),  which  produce  the  final 
scope,  film,  or  recorded  f-  or  t-domain  responses.  Most  of  the  individual 
errors  are  small. 


data  processing  error  estimates  nave  ranged  from  +6  dd  in  one  system  to 
essentially  zero  in  anotner  system,  in  frequency  intervals  extending  to  1  GHz. 
The  maximum  error  in  a  UaSET  or  AdSET  processing  system  is  about  +3  dd,  in  the 
absence  of  nonlinear  effects,  which  can  in  principle  be  removed  from  the  data. 
This  seems  to  be  a  reasonable  and  achievable  figure. 

Extrapolation  Uncertainties.  The  measured  wire  currents  from  a  test 
program  must  be  extrapolated  to  tnreat  conditions,  and  this  usually  introduces 
additional  uncertainties.  The  extrapolation  provides  corrections  for  incident 
field  amplitude  and  wave  shape,  incidence  angle,  and  polarization,  and  a  change 
from  ground  test  environment  to  threat  environment.  Tne  ground  plane  correc¬ 
tion  can  oe  important  for  aircraft  assessment  when  in-flight  currents  are  to 
De  extrapolated  from  test  data.  Ground  conductivity  effects  can  also  De  impor¬ 
tant  when  tne  system  to  be  tested  is  to  be  deployed  in  physical  environments 
quite  different  from  those  at  the  simulator  site.  For  instance,  estimates  of 
the  effect  of  ground  conductivity  on  the  reflected  wave  for  various  angles  of 
the  incident  wave  and  antenna  neight  indicate  tnat  it  could  cause  at  least  a 
4-dd  change  in  coupling  response. 

For  an  aircraft  where  free-field  penetration  into  tne  interior  through 
POE  is  the  critical  means  of  internal  excitation,  Rockwel 1  has  used  the 
surface  magnetic  field  (Hs)  at  the  various  POE  as  tne  extrapolation  quantity. 
lAfhen  more  than  one  POE  may  be  driving  a  given  internal  wire  to  an  unknown 
extent  compared  to  other  POE,  the  resultant  uncertainty  is  referred  to  by 
Rockwell  as  the  POE  location  error,  an  additional  source  of  extrapolation 
uncertainty. 

In  Rockwell's  assessment  method  1  (by  computer  program)  the  extrapolation 
ratio  (tnreat)^ree  sPace/H^  (simulator)  is  estimated  by  computer  programs. 
The  inherent  error  has  been  evaluated  by  comparison  with  Air  Force  Weapons 
Laboratory  (AFidL)  simulator  data.  For  the  EC-135  aircraft,  Rockwell  estimated 
the  POE  error  as  varying  from  wire  to  wire  between  +6  and  +10  dd.  These  errors 
should  oe  treated  as  independent  to  arrive  at  the  extrapolation  error. 

In  Rockwell's  assessment  method  2  (by  scale-model  aircraft  data),  an 
estimate  of  the  extrapolation  ratio  error  was  not  separated  from  the  POE  error. 
The  net  error  in  predicted  threat  wire  currents  due  to  both  sources  was  compu¬ 
ted  to  lie  between  +7  and  +12  dd,  depending  on  the  orientation  of  the  aircraft. 
Tnis  was  defined  as  "simulation  error"  by  Rockwell. 


Intrasystem  and  Intersystem  Variations.  EMP-induced  wire  currents  occur 
when  switching  from  power-on  to  power-off  operation.  In  addition,  variations 
have  been  observed  in  EMP  couplings  to  the  same  circuits  in  identical  systems. 
Even  within  a  given  system,  variations  in  internal  coupling  occur  from  day  to 
day  because  of  changes  in  physical  layout  and  changes  in  electrical  configura¬ 
tion.  These  variations  have  been  reported  for  aircraft,  but  they  likely  apply 
to  other  systems  as  well.  These  variations  are  strongly  system  dependent,  and 
data  on  them  are  scarce. 

For  the  EC- 13b,  rtockwell  reports  a  power  on-off  uncertainty  of  +10  dB. 

3  ~ 

Morgan  reports  a  spread  of  20  dB  at  identical  measurement  points  in 

different  samples  of  one  aircraft  type. 

B.  Computer  Simulation.  Computer  simulation  has  been  used  to  make  predic¬ 
tions  for  both  external  and  internal  coupling.  In  terms  of  uncertainty,  how¬ 
ever,  better  results  have  been  achieved  in  external  coupling.  In  the  follow¬ 
ing  discussion,  computer  simulation  predictions  are  compared  to  measured 
values,  and  the  differences  are  attributed  to  prediction  errors.  The  full- 
scale  system  test  errors  discussed  in  the  previous  section  can  produce  a  total 
uncertainty  between  +5  and  +6  dB.*  The  adequacy  of  any  computer  simulation 
technique  should  be  judged  with  these  numbers  in  mind. 

In  external  coupling  cases,  antennas,  cables,  and  external  system  ervel- 
opes  have  received  much  attention.  Antennas  have  been  analyzed  in  free  space 
and  over  ground  (both  lossy  and  perfect)  with  integral  equation  techniques.  A 
review  of  such  simulations  performed  by  Harry  Diamond  Laboratories  (HDL )  and 
LLNL  shows  that  peak  response  time-domain  errors  in  current  should  be  no 
higher  than  +4  dB.  Computer  code  predictions  of  aircraft  surface  current  tend 
to  have  error  ranges  somewhat  higher  than  this. 

Cable  coupling  studies  have  been  performed  using  transmission  line  theory. 
Cables  over  perfect  and  lossy  grounds  have  been  modeled.  The  largest  uncer¬ 
tainties  in  specifying  the  parameters  of  the  model  have  been  in  the  terminating 


*Measurement  and  data  processing  errors  are  independent  random  variables  and 
are  combined  in  the  usual  fashion  (i.e.,  square  root  of  the  sum  of  squares). 
Instrumentation  errors  are  not  random  and  are  added  linearly. 
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impedances.  It  appears  that  +3-d8  accuracies  can  be  achieved  in  predicting 
the  EMP-induced  current  entering  a  system  on  a  single  coaxial  or  multiwire 
shielded  transmission  line,  although  in  many  cases  only  +6-dB  accuracies  have 
been  reported.  Skin  currents  and  charges  induced  on  the  exterior  metallic 
envelopes  of  systems  have  been  computed  with  integral  equations  (i.e.,  wire- 
mesh  models)  and  finite-difference  schemes.  Objects  in  free  space  and  over 
ground  have  been  considered.  In  particular,  aircraft  have  been  extensively 
analyzed  in  this  fashion.  If  the  modeling  is  done  well,  uncertainties  can  be 
considerably  less  than  +10  dB.  Cases  have  been  reported  where  errors  of  +3  dB 
have  been  obtained  for  aircraft,  using  finite-difference  codes. 

Interior  coupling  predictions  have  been  made  by  first  computing  the 
currents  and  charges  induced  on  the  exterior  envelope  of  the  system,  as 
described  in  the  previous  paragraph.  These  are  used  to  define  equivalent 
sources  (both  electric  and  magnetic)  on  apertures,  which  in  turn  drive  internal 
cable  systems.  These  attempts  have  been  characterized  by  large  uncertainties 
because  of  the  difficulty  in  modeling  complex  apertures  and  random-run  multi¬ 
branch  cables.  In  addition,  it  is  often  not  possible  to  characterize  precisely 

the  load  impedances.  Error  intervals  for  internal  aircraft  cable  currents, 

2 

computed  analytically  by  Rockwell,  using  Bethe  aperture  penetration  theory 
and  circuit  analysis,  have  been  large,  typically  10  dB  and  more. 

C.  Scale-Model  Tests.  For  several  reasons,  scale-model  tests  have  not  been 
as  popular  in  EMP  coupling  assessment  as  full-scale  system  simulator  tests  and 
analysis.  Chief  among  these  reasons  is  the  difficulty  of  taking  measurements 
in  the  picosecond  time  regime.  Furthermore,  the  scaling  laws  for  nonmetallic 
objects  such  as  dielectrics  with  finite  conductivity  are  nonlinear  in  frequency, 
thus  making  scaling  very  difficult.  Most  reliable  results  are  achieved  for 
metallic  objects,  either  in  free  space  or  over  perfectly  conducting  ground 
planes.  Until  recently,  scale-model  tests  have  Deen  used  for  making  external 
coupling  measurements  only.  Recently,  internal  coupling  predictions  for  a 
ship  have  been  performed  by  LLNL,  and  the  predictions  have  been  compared  to 
full-scale  simulator  test  data.  Scale-model  tests  have  been  used  for  aircraft 
predictions  by  the  University  of  Michigan. 

The  sc ale- mod el  transient  facilities  are  prone  to  measurement  uncertain¬ 
ties.  LINL  reports  a  peak  time-domain  uncertainty  in  the  simulator  field  of 
less  than  +1  dB.  Instrumentation  plus  data  processing  errors  are  estimated  to 
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be  less  than  +4  dB.  The  University  of  Michigan  test  facility  is  reported  to 
have  a  simulator  field  uncertainty  less  than  +1  dB  at  frequencies  below  2  GHz 
(and  probably  about  the  same  up  to  6  GHz),  with  instrumentation  errors  less 
than  +3  dB  up  to  6  GHz.  Because  scale  models  are  usually  larger  than  about 
1/700  size,  this  frequency  range  scales  to  more  than  8.5  MHz  for  the  full-size 
aircraft.  Data  processing  errors  in  the  Michigan  facility  typically  appear  to 
be  +3  dB,  with  wide  variations  over  the  frequency  Dand  for  a  given  scale  model. 

The  University  of  Michigan  model  aircraft  data  contain  an  extrapolation 
error  (called  "simulation  error"  by  Rockwell,  as  mentioned  in  the  preceding 
section)  between  +7  and  +10  dB  for  skin  current  predictions. 

The  comparison  of  LLNL  predictions  with  full-scale  simulator  measurements 
by  the  Naval  Surface  Weapons  Center  (NSWC)  for  the  Canadian  ship  Huron  shows 
a  discrepancy  between  +7  dB  and  +10  dB  for  the  antennas  (due  to  measurement 
errors)  and  between  +2  and  +20  dB  for  internal  cables. 

D_. _ Current  Injection  Tests.  Surface  current  injection  testing  has  been 

performed  on  such  systems  as  aircraft  so  as  to  excite  the  first  one  or  two 
natural  modes  reasonably  accurately,  compared  to  EMP.  But  the  surface  current 
response  has  been  well  matched  over  only  part  of  the  EMP  spectrum.  The  meager 
amount  of  published  data  on  systems  suggests  a  reasonable  and  achievable  error 
of  +6  dB  in  derived  EMP  surface  temporal  response. 

E.  LLNL  Modular  data.  Modular  data  have  been  generated  by  cLNlJ  for  various 
generic  classes  of  structures,  using  both  computer  models  and  scale-model 
tests.  Tnese  modules  provide  quick-look  external  coupling  estimates  of  induced 
quantities  of  interest,  such  as  current,  voltage,  power,  and  energy.  The  data 
are  provided  in  parameterized  form  and  can  be  easily  scaled.  Generic  classes 
considered  include  straight  wires  and  loops  in  free  space,  whips  and  loops  on 
boxes,  and  whips  and  loops  on  cylinders.  When  compared  to  actual  system  test 
results,  the  module  prediction  accuracies  ranged  between  1  and  9  dB.  The 
accuracy  is  best  for  structures  that  deviate  little  from  the  generic  form  and 
worsens  as  the  deviation  increases. 
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3.2  SUSCEPTIBILITY 


As  an  element  of  vulnerabi 1 ity  assessment  and  hardening,  subsystem  and 
component  susceptibility  very  rarely  can  be  stated  in  terms  of  the  exact 
environment.  Usually,  susceptibility  is  determined  for  a  class  of  environ¬ 
ments  that  in  some  sense  approximates  the  actual  case.  The  determination  or 
specification  of  the  class  relies  very  strongly  on  the  interaction  and  coupling 
technology.  Typical  classes  of  environments  are  families  of  exponentially 
damped  sinusoids  of  current  or  voltage  that  are  used  to  drive  cables  or 
terminals  of  subsystem  units.  Another  common  class  is  a  set  of  unipolar 
pulsed  signals  impressed  on  the  terminals  of  individual  components. 

Analytical  investigations  of  the  susceptibility  of  both  circuits  and 
components  frequently  employ  the  same  classes  of  environmental  signals.  Thus, 
if  susceptibility  depends  strongly  on  the  details  of  an  environment,  large 
systematic  error  is  introduced  into  the  assessment.  Such  errors  might  not  be 
recognized  until  a  system  test  is  performed.  Clearly,  the  susceptibility  of  a 
subsystem  or  circuit  depends  on  the  interior  configuration,  thus  errors  are 
introduced  by  assumptions  concerning  this  configuration. 

3.2.1  Subsystem  Assessment 

Subsystem  assessment  work  may  be  faced  with  different  uncertainties, 
depending  on  the  requirements.  There  is  no  standard  practice  in  subsystems 
work.  Instead,  there  are  at  least  three  different  ways  of  approaching  the 
problem: 

•  Assessment  relative  to  a  specification  placed  on  the  interface  of  the 
subsystem.  (For  example,  the  B-l  Aircraft  or  Advanced  Airborne  Command  Post 
Pin  Specification.) 

•  Assessment  that  uses  a  replica  or  an  extrapolation  of  the  actual 
signal  present  in  the  system  (as  might  be  obtained  from  tests  on  a  missile 
system) . 

•  Assessment  that  uses  a  "representation,"  because  the  number  of 
subsystems  is  so  large  that  it  precludes  detailed  analysis  or  investigation  of 
all  of  them.  This  approach  could  introduce  much  judgmental  uncertainty,  as 
well  as  systematic  errors. 


A.  Uncertainties  in  Methodology  Development.  By  definition,  a  methodology 
should  be  a  precise  and  orderly  procedure.  In  practice,  it  could  be  a  highly 
adaptive  and  ad  hoc  procedure,  designed  to  fit  the  situation  (e.g.,  to  elimi¬ 
nate  or  add  tests).  The  compromises  made  in  developing  a  methodology  for  a 
particular  program  are  usually  recognized,  but  their  full  significance  in  terms 
of  the  errors  they  generate  may  not  be  realized.  Each  methodology  places 
emphasis  on  those  phases  of  activity  that  are  important  to  the  project  at  hand. 
For  example,  a  decision  not  to  do  any  testing  because  of  costs  or  other  reasons 
would  create  a  different  set  of  uncertainties  than  if  both  tests  and  analyses 

were  performed.  The  Advanced  Airborne  Command  Post  (AABNCP)  Assessment 
5  6 

Program  *  is  an  example  of  a  strong  methodology,  heavily  based  on  existing 
data,  but  backed  up  with  tests  on  selected  subsystems  for  the  verification  of 
predicted  failure  levels.  Chapter  13  of  the  DNA  EMP  Handbook^  includes  a 
generic  approach  to  assessment  and  lists  some  of  the  issues  involved. 

B.  Uncertainties  in  Analysis.  In  subsystems  susceptibility  work,  analysis 
can  mean  doing  a  simple  screening  of  susceptible  components  on  a  penetration 
interface,  or  it  can  mean  performing  a  detailed  circuit  analysis  from  the 
interface  through  several  critical  components. 

Uncertainties  in  analysis  arise  from  the  lack  of  suitable  large-signal- 
level  models  for  components,  the  lack  of  information  on  circuit  and  device 
parameters,  and  a  general  inability  to  handle  very  large  problems.  Engineering 
judgment  is  used  to  simplify  the  circuit  for  analysis,  and  the  errors  are  not 
always  evaluated  by  experiment. 

C.  Uncertainties  in  Testing.  One  of  the  largest  uncertainties  in  testing  may 
result  from  not  being  able  to  inject  signals  to  all  circuit  terminals  simultan¬ 
eously.  This  is  a  good  argument  for  doing  a  systems  test  at  one  point  in  the 
development  cycle  of  the  system.  Ground  loops  and  other  problems  unique  to 
the  type  of  interconnection  may  not  show  up  in  subsystem  or  unit  tests. 

Another  uncertainty  arises  in  the  simulation  of  the  actual  interface  EMP 
signal.  It  is  of  interest  to  compare  the  set  of  test  signals  and  their  effect 
on  the  subsystem  or  unit  with  a  set  of  possible  EMP  signals.  The  executive 

5 

summary  report  of  the  AABNCP  program  contains  information  on  the  relative 
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accuracy  of  subsystem  assessment  analysis  compared  to  certain  test  results. 

The  results  show  that  the  analysis  was  generally  conservative,  with  a  > ange  of 
0.35  to  744  for  ratios  of  failure  current  (test)  to  failure  current  (analysis). 

0.  Uncertainties  in  Data  Handling.  The  nandling  and  processing  of  data  in  the 
bandwidths  and  quantities  required  for  EMP  assessments  appear  to  cause  concern 
more  for  economic  reasons  than  for  the  errors  and  uncertainties  generated. 
Reference  6  discusses  the  handling  of  subsystem  functional  description  data. 

E.  Uncertainties  in  Conf iquration.  A  spec  if ication  may  or  may  not  be  closely 
tied  to  the  actual  operating  environment  from  EMP- induced  signals.  Uncertainty 
arises  from  the  use  of  an  interface  specif ication  that  permits  subsystems 
design  or  assessment  to  conform  to  a  uniform  criterion.  Regardless  of  the 
specification,  however,  a  major  uncertainty  in  the  analysis  of  subsystems 
results  from  assuming  the  basic  conf iguration  of  the  subsystem.  Such  an  uncer¬ 
tainty  can  not  be  easily  resolved  and  can  therefore  cause  large  errors  in 
assessment.  An  example  is  the  assumption  of  no  direct  conduction  path,  where 
in  fact  there  is  one.  Circuit  analysis  by  computer  plays  a  significant  role 
in  subsystem  assessment,  and  it  reiies  heavily  on  suitable  determinations  of 
configuration. 

3.2.2  Components  Assessment 

There  nas  been  much  investigation  of  the  physics  of  failure,  of  various 
failure  modes,  and  of  thresholds  for  many  different  devices.  Given  the  large 
number  of  oevices,  however,  particularly  the  more  susceptible  solid-state 
components,  it  is  rare  that  a  single  device  can  be  controlled  and  studied  in 
detail.  Instead,  through  use  cf  small  samples,  attempts  have  been  made  to 
derive  general  models  that  can  be  used  with  prediction  techniques.  Such  models 
include  the  familiar  power  dissipation  formula  for  a  semiconductor  junction: 

P  =  kt"1/2  , 

where  P  is  the  failure  power,  t  is  the  pulse  width  (duration),  and  k  is  a 
constant.  An  empirical  extension  to  the  case  of  integrated  circuits  has  the 
form 

P  =  At"8  , 
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where  A  and  B  are  empirically  determined  constants. 

Uncertainties  have  several  sources: 

•  Use  of  theoretical  models  for  damage  prediction. 

•  Waveform  differences  between  the  actual  system  and  the  component  test. 

•  Ranges  of  distribution  of  failure  parameters. 

•  Definitions  of  integrated-circuit  damage. 

Theoretical  models  must  resort  to  published  data  on  device  parameters, 
usually  based  on  junction  capacitance.  Waveform  differences  are  significant 
when  a  device  exhibits  a  lower  failure  level  for  one  polarity  than  the  other, 
or  when  the  failure  level  is  affected  by  repeated  pulses  of  varying  polarity. 
Testing,  however,  is  usually  performed  with  step-stressing  at  one  polarity. 
Sometimes  it  is  actually  quite  difficult  to  determine  when  an  integrated 
circuit  has  failed.  Degradation  of  certain  device  parameters  is  possible 
without  catastrophic  failure. 


A.  Experimental  Uncertainties  in  Component  Testing- 

Environment  Simulation.  Very  little  testing  of  components  is  performed 
with  a  simulation  of  the  actual  in-place  or  in-circuit  environment.  For 
reasons  of  economy  and  ease  of  generation,  testing  is  done  primarily  with  a 
unipolar  pulse  waveform.  A  high  degree  of  automation  is  employed  in  testing. 
Actual  environment  waveforms  (as  observed  from  system  EMP  simulation  tests) 
are  nearly  always  some  variation  of  a  damped  sinusoid,  with  a  frequency 
content  that  depends  on  the  system  configuration. 

Instrumentation.  Sensing  of  voltage  and  current  is  not  a  major  source  of 
uncertainty.  Step-stressing  is  commonly  used,  so  large  errors  are  unlikely. 
However,  determination  of  exact  time  of  failure  can  be  a  source  of  error. 
Pretest  instrumentation  normally  involves  an  automated  parameter-measuring 
test  set;  posttest  determination  of  possibly  degraded  parameters  can  then  be 
evaluated  by  the  same  test  set,  thereby  removing  an  uncertainty  through 
standardizing.  Absolute  errors  or  uncertainties  in  component  use  for  a 
particular  application,  however,  are  only  as  good  as  the  completeness  of 
coverage  of  the  original  parameter  test  set.  Measurement  and  digitizer  errors 
have  been  shown  to  be  less  than  25%  for  worst  cases  and  less  than  10*  for  rms 
variations.  Test  methodology  and  error  analysis  are  discussed  in  Appendices  A 
and  B  of  Ref.  8. 


d.  Uncertainties  in  Analysis.  Chapter  13  on  "Component  EMP  Sensitivity  anJ 
System  dpset"  of  the  DNA  £MP  Handbook'7  also  contains  some  general  information 
on  uncertainties  or  accuracy  factors  of  variaDles  as  used  in  analysis.  The 
three  phases  of  damage  analysis  methodology  are  data  acquisition,  detailed 
theoretical  analysis,  and  susceptibility  screen  development. 

data  Acquisition.  The  detail  and  quality  of  data  on  subsystem,  circuits, 
and  components  available  for  analysis  vary  considerably.  It  is  often  necessary 
t.o  infer  circuit  parameters  from  schematics,  and  some  circuit  details  may  not 
be  available.  The  availability  and  accuracy  of  failure  parameters  for  devices 
is  one  of  the  most  significant  constraints  in  performing  an  EMP  assessment. 

Some  methods  for  obtaining  component  failure  parameters,  in  addition  to  doing 
actual  testing,  are  the  use  of  data  with  the  AFWL's  code  SdPERSAP,  the  use  of 
existing  equations  (supplemented  by  measurement),  the  use  of  equations  and 
certain  published  data,  and  the  estimation  of  damage  tnresholds  in  various 
general  categories  of  devices.  Threshold  values  can  easily  vary  tenfold. 

Detailed  Theoretical  Analysis.  Detailed  theoretical  analysis  at  the 
circuit  level  requires  several  types  of  information  and  tools,  each  of  which 
can  involve  a  large  amount  of  uncertainty. 

The  principal  tools  for  complex  circuits  are  che  large,  general-purpose 
circuit  and  system  codes,  such  as  CIRCUS,  NET-2,  SCEPTRE,  etc.  Complete 
circuit  simulation  is  possible  in  principle,  but  may  be  prohibiti vely  costly. 
Much  smaller  codes,  such  as  HANAP2,  are  also  used.  A  simplification  of  the 
circuit  to  reduce  tne  complexity  could  omit  important  responses.  A  prelim¬ 
inary  analysis  by  an  engineer  familiar  with  the  design  of  the  circuit  will 
conveniently  eliminate  certain  sections  or  components,  but  there  is  uncertainty 
in  accounting  for  the  possibility  of  damaging  a  "buried"  circuit  component, 
with  no  apparent  direct  connection  to  the  circuit  of  concern.  Judgmental 
errors  will  arise  in  the  simplification  of  circuits  for  analysis. 

Screening  for  Susceptibility.  Screening  of  subsystems  or  components  for 
hardness  uses  some  method  of  ranking  components  for  inherent  hardness.  This 
can  be  quite  simple,  involving  little  uncertainty,  such  as  screening  out  all 
semiconductor  circuits  as  being  innerently  soft.  A  more  sophisticated  screen 
uses  values  of  failure  threshold  parameters  for  devices,  such  as  a  K  (Nunsch 
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constant)  value.  Lack  of  proper  data  concerning  a  circuit  description  can 
cause  a  great  amount  of  uncertainty  in  all  cases.  For  instance,  an  assumption 
that  a  circuit  is  not  a  solid-state  one,  when  in  fact  it  must  be  to  function 
properly,  would  create  serious  susceptibility  uncertainties  regardless  of  the 
method  of  screening  used. 


3.2.3  Summary 

A.  Circuits  and  Subsystems.  Sources  of  uncertainty  include: 

•  Circuit  parameters,  specific  devices/circuits. 

•  Transformer  coil  nonlinear  effects. 

•  High-level  solid-state  device  models/response. 

•  Indirect  coupling  to  "buried"  circuits. 

•  Simultaneous  pin-  or  port-excitation  effects. 

•  Power-on  vs  power-off  effects. 

•  Function  definitions. 

•  Stray  element  effects. 

It  would  be  very  difficult  in  general  to  quantify  the  errors  associated 
with  each  item  on  the  above  list.  Many  of  these  uncertainties  depend  on  the 
level  of  detail  available  for  the  subsystem  or  circuit  being  assessed.  Cor¬ 
relations  of  predicted  subsystem  unit  failure  thresholds  with  test  results 

5 

indicate  that  analysis  techniques  have  been  generally  conservative.  Some 
of  these  results  are  summarized  in  Table  3.1.  The  values  represent  ratios  of 
box-pin-test  failure  (current  and  voltage)  thresholds  (subscript  F)  to  analyt¬ 
ically  predicted  thresholds  (subscript  T)  for  fifteen  electronics  units  from 
eight  different  subsystems.  The  posttest  comparisons  include  some  modifica¬ 
tions  in  the  analysis,  such  as  component  test  results,  revised  information  on 
components  values,  circuits  topology,  etc.,  which  were  absent  in  the  pretest- 
predictions. 

In  both  the  AABHCP  and  EC- 135  assessment  programs,  box-pin  tests  were 
performed  for  several  boxes.  The  more  recent  EC-135  program  included  a 
summary  of  box-level  data  points  for  both  assessment  programs,  shown  in 
Table  3.2. 

The  EC-135  prediction  data  include  the  effects  of  semiconductor  junction 
bulk  resistance,  while  the  AABNCP  data  do  not.  The  data  fror.  the  tables 
suggest  that  the  calculated  thresholds  provide  a  reliable  lower  bound  for 
subsystem  boxes. 


TABLE  3.1.  Comparison  of  tested  failure  threshold  (F)  to  theoretical 
thresholds  (T)  for  subsystem  electronic  boxes  (Ref.  5). 


Posttest  (revised)  comparisons 


Pretest  comparisons 


If/It 


Vp/Vf 


ip/i  r 


V ;-/  V  J- 


number 

Min 

Max 

Min 

Max 

Min 

Max 

Min 

Max 

1 

7.88 

8 

1.2 

8 

2 

0.64 

156 

0.92 

258 

0.64 

156 

0.6 

258 

3 

6.7 

8.1 

8.1 

8.6 

6.7 

8.1 

8.1 

8.6 

4 

0.5 

3 

5 

17 

0.5 

2.4 

1.1 

9.6 

5 

0.7 

>12 

>0.3 

>0.6 

0.7 

>12 

>0.3 

7.6 

6 

1.9 

7.5 

1.3 

3.7 

1.9 

3.1 

0.56 

1.6 

7 

1.7 

12 

1.3 

4.0 

0.35 

9 

0.17 

2.5 

3 

78.9 

744 

71.1 

>1.5 

9 

1.5 

11.3 

2.0 

3.7 

0.7 

5.1 

4.5 

25 

10 

1.9 

4.2 

1.3 

2.8 

2.4 

9.8 

1.3 

10.7 

11 

1.2 

1.5 

0.44 

0.68 

0.69 

8.5 

0.07 

3.8 

12 

No  burnout  noted- 

-transmissibi 1 ity  assumptions  verified 

13 

No  burnout  thresholds  noted- 

-arc-over  predictions  verified 

14 

3.7 

37 

3 

9 

8 

22 

1.8 

n 

15 

1.17 

10.1 

2.02 

10.1 

1.17 

10.1 

2.02 

10.1 

TABLE  3.2. 

Summary  of  box- level 

data  points  for  two 

assessment 

programs 

(Ref.  2). 

Number  of  data  points 


No.  of 
boxes 

Program  tested 

EC-135  9 

assessment 

AABNCP  GFE  15 
assessment 


Burnouts>  8urnouts< 
predicted  predicted 


Test 

stopped> 


Test 

stopped< 


Total 

data 


prediction  prediction  points 


65  total 
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B.  Components.  Sources  of  uncertainty  include: 

•  Damage  prediction  with  theoretical  models. 

•  Waveform  differences  between  the  actual  system  and  the  component  test. 

•  Distribution  of  thresholds. 

•  Definitions  of  integrated-circuit  damage. 

•  Unexpected  failure  modes. 

•  Lot-to-lot,  manuf acturer-to-manuf acturer  variations. 

•  Effect  of  lead  inductances  in  testing. 

•  Unipolar  step-stressing  quantization  error. 

There  is  much  quantitative  information  on  component  device  threshold 

variability.  Chapter  13  of  the  DNA  EMP  Handbook^  contains  information  on 

the  relative  damage  susceptibility  of  electronic  components.  (The  threshold 

ranges  for  the  different  general  classes  of  components  are  shown  in  Fig.  3.1.) 

The  handbook  also  presents  estimated  values  for  K,  the  damage  constant,  for 

different  device  categories.  The  information  includes  K  ,  with  upper  and 

mean 

lower  95%  confidence  limits,  for  several  types  of  diodes  and  transistors.  The 
sample  size  for  each  type  varies  from  2  to  56.  Nearly  all  limits  are  a  factor 
of  10  (or  more)  above  or  below  the  Kmean  values.  There  is  also  a  summary  of 
integrated-circuit  threshold  variations  by  category.  Limits  are  given  for  the 
parameter  A,  in  the  failure  model  P  =  At~S,  for  the  TTL,  RTL,  DTL,  ECL,  MOS, 
and  LINEAR  families  of  devices.  These  limits  range  from  a  factor  of  2.1  to  13 
above  or  below  the  &mean  values.  Such  variation  will  produce  variations  in 
burnout  power  (1-ps  pulse  width)  of  5  to  200  W  for  all  families,  and  limits 
as  high  as  6  to  1100  W  for  one  family  (LINEAR). 

Data  are  also  available  that  compare  transistor  and  diode  test  results  with 
predicted  damage  constants  (K  factors).  For  example,  the  data  in  Table  3.3 
illustrate  the  range  of  ratios  of  test  K  factors  to  predicted  K  factors  for 
the  junction  capacity  prediction  model.  The  other  models  (thermal  resistance) 
have  greater  variation.  Diodes  show  a  greater  range  of  uncertainty,  but  the 
sample  size  was  smal 1 . 

Separate  models  for  classes  of  devices  have  also  been  developed  and  studied 

q 

at  General  Electric  Co.  One  report  discusses  damage  models  developed  for 
classes  of  diodes  and  uses  the  existing  experimental  data  base  for  input. 

Models  are  presented  in  the  form  of  equations  that  include  certain  device 
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FIG.  3.1.  Range  -4  thresholds  (Pp)  showing  relative  damage  susceptibilities 
of  electronic  components.  The  threshold  at  1  ps,  in  kW,  is  equal  to  the  K 
factor. 


TABLE  3.3  Comparisons  of  test  K  factors  to  predicted  K  factors  for  transistors 
and  diodes,  using  the  junction  capacity  model. 


_ Transistors _ 

Collector-base  Base-emitter  Diodes 

Measured  (16  samples)  ( 16  samples)  (6  samples) _ 

parameter _ Min  Max  Range _ Min  Max  Range _ Min  Max  Range 


Power 

0.78 

19 

24 

0.16  9.2 

58 

0.014  1.7 

121 

Current 

0.35 

23 

66 

0.05  2.1 

42 

0.010  1.0 

parameters  (such  as  breakdown  voltages  at  low  level),  and  that  also  provide  o 

factors  as  multipliers.  The  value  of  o  for  Ipp  (reverse  current  damage)  is 

1.58  for  a  1N4148  diode;  2.51  for  rectifiers,  diodes,  and  switches;  and  2.14 

for  zener  diodes.  In  a  second  report,^®  252  integrated  circuits  of  several 

types  were  tested  and  modeled,  with  confidence  limits  as  a  multipliers 

included.  There  are  models  for  RTL,  DTL,  TTL  (several  types),  ECL,  and  LINEAR 

circuits.  Sigma  factors  range  from  1.4  to  4.8  f^r  models  of  the  form  P  = 

-B 

At*  .  References  9  and  10  should  be  consulted  for  the  appropriate  model  to 
be  used  with  each  class  of  device  and  for  each  input  terminal. 

4.0  COMPARISON  OF  VULNERABILITY  ASSESSMENT  TECHNIQUES 

An  assessment  technique,  whether  based  on  simulated  or  full-scale 
testing,  system  modeling,  or  analysis,  is  likely  to  vary  with  each  problem, 
depending  on  the  circumstances  of  the  assessment.  Several  factors  which 
affect  the  choice  of  methodology  are: 

•  State  of  system  development:  is  it  a  new  system,  deployed  system, 
upgraded  or  revised  system,  etc.? 

•  Level  of  knowledge  of  the  threat  or  of  the  system  and/or  the 
components:  to  what  extent  is  the  environment  known,  to  what  extent  is  the 
system  coupling  known,  what  is  known  about  component  susceptibility? 

•  Availability  of  resources:  what  funding,  expertise,  or  time  is 
available  for  the  assessment? 

•  Other  constraints:  is  the  system  available  for  testing,  etc.?  These 
and  other  factors  influence  not  only  the  choice  of  overall  methodology,  but 
also  the  particular  techniques  used  within  the  framework  of  the  overall  method. 


Whatever  the  methodology  considered,  it  is  important  that  the  technique 
accommodate  the  many  uncertainties  that  may  affect  the  assessment  results. 
Again,  it  is  expected  that  uncertainties  be  handled  differently  in  different 
methodologies.  Also,  the  extent  to  which  uncertainties  enter  into  the 
analysis  will  change  from  situation  to  situation.  Certainly,  the  availability 
of  information  regarding  the  uncertainties  in  the  assessment  parameters  will 
determine  how  extensive  an  analysis  of  uncertainties  is  performed. 

The  following  paragraphs  outline  briefly  some  of  the  methods  used  in 
vulnerabi 1 ity  assessments  of  large  systems.  They  are  followed  by  a  description 
and  discussion  of  how  uncertainties  are  handled  within  the  method. 

4.1  HDL  ASSESSMENT  METHODOLOGY 

One  assessment  technique  is  exemplified  by  the  methodology  developed  and 
used  by  HDL  in  the  Multiple  Systems  Evaluation  Program  (MSEP).^  This  tech¬ 
nique  makes  heavy  use  of  analytically  oriented  coupling  and  circuit-code 
models.  Test  data  on  system  components  and  system  coupling  are  used  both  for 
developing  the  computer  models  and  as  a  source  of  inputs  to  the  system  assess¬ 
ment.  Uncertainties  are  included  at  all  stages  of  the  analysis.  They  include 
uncertainties  in  the  system  model,  uncertainties  in  component  susceptibility, 
uncertainties  in  component  responses  due  to  modeling,  etc.  These  uncertainties 
are  not  probabi 1 istical ’y  stated,  but  are  used  for  detailed  modeling  and  calcu¬ 
lations  to  obtain  a  worst-case  assessment. 

4.2  ROCKWELL  ASSESSMENT  METHODOLOGY 

An  alternative  assessment  method  was  applied  by  Rockwell  International  to 
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an  assessment  of  the  EC-135  aircraft.  This  method  is  based  on  measurements 
of  the  transient  currents  and  voltages  in  the  aircraft  while  it  is  in  a  simula¬ 
ted  environment.  These  currents  and  voltages  were  analytically  extrapolated 
to  threat  level,  and  the  dB  difference  between  a  component  threat  current  and 
its  susceptibility  was  defined  as  a  "hardness  margin"  for  that  component.  The 
extrapolation  of  test  data  to  criterion  level  was  based  on  extrapolation 
functions  determined  either  from  mathematical  models  or  from  scale-model  tests. 
Uncertainties  in  the  test  measurements,  susceptibility  data,  and  extrapolation 


functions  were  described  probabilistically  and  were  propagated  throughout  the 
analysis,  using  the  methods  of  statistical  error  propagation.  The  final 
assessment  results  were  stated  as  a  reliability-confidence  interval. 

4.3  BOEING  ASSESSMENT  METHODOLOGY 

The  Boeing  Aerospace  Corporation  has  developed  assessment  methods  to 

predict  the  communication  impairment  of  communication  facilities  in  a  threat 
12  13 

environment.  ’  The  method  employs  both  electrical  and  functional  models. 

The  former  .s  used  to  determine  the  input  at  critical  components  throughout  the 
system.  This  in  turn  is  compared  to  the  component  failure  threshold  to  deter¬ 
mine  a  proDability  of  disruption.  These  probabilities  are  then  applied  to  the 
functional  model  to  determine  a  probability  of  communication  impairment. 
Uncertainties  in  inputs,  component  and  system  parameters,  etc.,  are  introduced 
using  the  concept  of  "data  quality." 

4.4  TRW  WORK 

14 

In  other  work,  TRW  studied  the  general  problem  of  methodologies  for 
vulnerability  assessment,  specifically  as  applied  to  aircraft.  Its  study 
suggested  that  all  assessment  concept  alternatives  could  be  obtained  by 
answering  the  following  seven  basic  questions: 

1.  What  survivability  statements  constitute  an  answer  in  the  assessment? 

2.  What  is  the  basis  for  establishing  these  survival  statements? 

3.  What  is  the  threshold  concept?  (How  is  it  characterized  and  referenced?) 

4.  What  is  the  extrapolation  concept?  (How  is  coupling  to  the  threshold 
point  determined?) 

5.  What  is  the  final  assessment  analysis  concept?  (What  is  the  technical 
basis  for  data  analysis?) 

6.  What  is  the  simulation  philosophy? 

7.  What  is  the  test  object  configuration  philosophy? 

TRW  proceeds  in  the  study  to  enumerate  eleven  assessment  concepts  that 
include  three  possible  threshold  reference  locations  and  four  possible 
extrapolation  concept  alternatives: 


t 


Threshold  references 

Tl.  Pressure  hull  interface. 

T2.  Pressure  hull  (damage),  subsystem  box  interface  (upset). 

T3.  Subsystem  box  interface. 

Extrapolation  concept 
El.  Analytical  model. 

E2.  Hybrid  analytical  model. 

E3.  Oirect  extrapolation  of  system  test  data  by  scalar  multiplier. 

E4.  Threat-level  direct  drive  on  portions  of  the  system,  based  on  subthreat 
excitation  of  total  system. 

Only  the  combination  of  T3  and  El  was  considered  not  viable  due  to  state- 
of-the-art  limitations  in  internal  coupling  analyses.  The  purpose  of  this 
phase  of  the  study  was  to  develop  the  concepts  and  to  identify  data  and  tech¬ 
nology  needed  to  implement  these  concepts.  TRW  did  not  choose  an  optimum 
candidate  concept. 

One  method  based  on  the  concepts  outlined  by  TRW  is  a  probabilistic 
analysis  that  makes  extensive  use  of  simulation  to  assess  system  survivability. 
One  version  of  the  probabilistic  analysis,  as  applied  by  LLNL  to  two  simple 
systems,  is  described  in  Section  5.  With  regard  to  uncertainties,  the  prob¬ 
abilistic  analysis  distinguishes  between  random  and  systematic  uncertainties 
in  all  assessment  variables.  For  any  fixed  systematic  error,  the  effect  of 
random  variations  on  the  value  of  the  probability  of  survival  is  assessed  by 
Monte  Carlo  methods.  The  result  is  an  estimate  of  the  probability  of  survival. 
By  varying  the  systematic  error,  a  distribution  of  estimates  can  be  generated. 
In  turn,  a  confidence  interval  (or  confidence  bound)  can  be  evaluated  from  this 
distribution.  The  final  result  is  an  estimate  of  the  probability  of  survival, 
stated  with  a  measure  of  confidence.  This  method  relies  heavily  on  computer 
modeling,  both  in  terms  of  the  inputs  (threat,  system  parameters,  system  opera¬ 
tion,  etc.)  and  the  uncertainties  (random  and  systematic).  Thus,  TRW  has 
developed  several  computer  codes14,15,16  (e.g.,  SANE,  SURVIVE,  FAST)  to  perform 
this  type  of  analysis.  Many  simplifying  assumptions  have  been  made  in  develop¬ 
ing  these  codes,  hence  the  applicability  of  such  codes  to  vulnerability  assess¬ 
ment  is  questionable.  One  of  the  purposes  of  the  LLNL  study  was  to  determine 
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whether  a  probabilistic  analysis,  based  on  a  computer  model  (FAST),  would 
generate  estimates  that  could  be  verified  by  laboratory  experiments  for  simple 
systems.  TRW  has  recently  applied  this  type  of  methodology  to  assess  the 
survivability  of  a  radio  system  when  subject  to  the  EMP  of  a  high-altitude 
burst. 

4.5  DISCUSSION 

All  of  the  methodologies  outlined  above  consider  uncertainties  in  the 
assessment  variables,  but  the  degree  to  which  these  uncertainties  affect  the 
analysis  and  the  types  of  results  differs  considerably  among  methods.  The  HDL 
approach  to  uncertainties  is,  as  taken  in  MSEP,  the  simplest.  The  quantity  of 
real  interest  in  this  approach  is  the  largest  value  of  the  uncertainty.  This 
is  used  in  a  worst-case  analysis  to  evaluate  the  worst-case  margin  of  safety, 
thus  resulting  in  a  conservative  assessment.  This  type  of  assessment  indicates 
the  vulnerability  in  an  extreme  situation;  it  fails  to  recognize  that  such  a 
situation  occurs  with  a  very  low  probability.  Also,  no  matter  what  value  is 
used  for  the  largest  uncertainty,  it  is  likely  that  this  is  not  an  absolute 
upper  bound.  Instead,  it  is  likely  to  be  a  value  that  will  not  be  exceeded 
with  high  probability.  Thus,  the  HDL  approach  may  not  in  fact  produce  a  worst- 
case  analysis.  The  methodologies  used  by  Rockwell  and  Boeing,  and  suggested  by 
TRW,  treat  uncertainties  as  probabilistic  quantities:  the  values  of  the  uncer¬ 
tainties  are  assumed  to  be  described  by  a  probability  distribution.  Boeing 
introduces  uncertainties  in  the  assessment  variables  through  a  factor  called 
"data  quality"  (DQ).  It  is  assumed  that  the  uncertainty  in  the  safety  margin 
(the  logarithm  of  the  ratio  of  the  failure  threshold  signal  to  the  response 
signal)  is  due  to  one  of  three  types  of  variation: 

1.  Random  variation  among  similar  units,  which  assumes  that  the  "true" 

population  safety  margin  is  known. 

2.  System  variation  in  the  safety  margin  of  the  specific  unit  being  tested. 

3.  Systematic  plus  random  variation  in  the  observed  safety  margin. 

The  distribution  in  the  safety  margin,  as  described  by  DQ,  is  used  to 
evaluate  the  probability  of  unit  survival  in  case  1  or  to  evaluate  the  "confi¬ 
dence"  that  the  unit  survives  in  cases  2  and  3.  These  probabilities  (or 


confidences)  are  combined  to  evaluate  the  corresponding  measure  of  system 
survivability.  The  initial  analyses  done  by  Boeing  assumed  that  the  distribu¬ 
tional  parameters  are  known.  Later  work^  extended  the  methodology  to 
include  situations  in  which  the  parameters  are  estimated  from  sample  data 
("extended  data  quality")  and/or  mathematical  modeling  is  used  to  predict  the 
inputs  into  the  vulnerability  assessment  ("model  prediction  coefficient"). 

This  method  of  accommodating  uncertainties,  as  used  by  Boeing,  relies  on 
a  single  measure  to  describe  uncertainty,  whether  it  is  random  or  systematic. 
Thus,  the  effect  of  these  uncertainties  cannot  be  separated  in  sensitivity 
analyses.  Also,  in  extending  the  methodology  to  include  mathematical  modeling 
uncertainties  and  parameter  estimation  uncertainties,  a  simplifying  assumption 
of  Gaussian  variation  was  made.  This  restricts  the  applicability  of  the 
method.  Further,  the  use  of  the  term  "confidence"  is  specialized  and  could 
lead  to  confusion  with  the  more  common  meaning  of  the  term. 

Rockwell  uses  a  reliability-confidence  interval  as  a  measure  of 
uncertainty  in  a  variable.  We  define  it  as  follows: 

A  6  100%  -  y  100%  reliability-confidence  interval 
for  a  variable  I,  given  by  +_AI,  means  that,  based  on 
test  data,  if  IQ  is  the  "nominal"  value  of  I,  then 
one  is  y  100%  confident  that  at  least  (5  100%  of  the 
values  of  I  within  the  appropriate  population  will  be 

in  the  interval  (I  -  AI ,  I  +  AI ) 

o  o 

Thus,  reliability-confidence  intervals  are  statements  of  bounds  between 
which  a  stated  percentage  of  values  of  a  variable  can  be  expected  to  lie.  The 
"quality"  of  the  methods  used  to  determine  these  sounds  is  expressed  by  the 
confidence  statement.  In  contrast  with  Boeing's  use  of  the  term  "confidence," 
the  usage  here  is  consistent  with  that  usually  found  in  the  statistical  liter¬ 
ature.  Rockwell's  definition  of  the  term  "reliability"  is  a  generalization  of 
the  term  as  it  is  used  in  system  and  component  reliability  theory.  Their  def¬ 
inition  also  includes  the  more  common  daily  and  legal  applications,  e.g.,  "That 
statement,  or  testimony,  is  highly  reliable."  See  Ref.  18  for  a  definition  of 
"reliability"  as  used  by  Rockwell.  In  particular,  in  the  context  of  the  reli¬ 
ability-confidence  interval  for  a  variable  I,  Rockwell  uses  reliability  to 
denote  a  lower  bound  on  the  probability  that  variable  I  will  be  within  a 
specified  interval.  If  I  denotes  the  safety  margin  of  a  system  and  the 


interval  is  all  values  above  zero,  then  Rockwell's  use  of  the  term  reliability 
coincides  with  -ie  use  conventional  in  the  world  of  system  and  component 
reliability  theory. 

Re1 i v:i 1 i ty-conf idence  intervals  for  all  input  variables  are  assumed 
inputs  to  the  assessment  analysis.  These  variables  (and  intervals)  are  analy¬ 
tically  combined  to  evaluate  the  safety  margin  (and  interval)  for  individual 
components.  These  are  ultimately  combined  for  a  system  safety  margin  determin¬ 
ation.  The  final  output  is  an  estimated  lower  bound  for  the  probability  that 
the  system  safety  margin  is  greater  than  zero,  where  the  estimate  is  given 
with  a  specified  level  of  confidence.  One  major  problem  with  the  approach 
used  by  Rockwell  in  accommodating  uncertainties  is  the  method  used  for  combin¬ 
ing  uncertainties.  Two  types  of  reliability-confidence  intervals  are  develop¬ 
ed,  one  assuming  Gaussian  variables  and  the  other  a  nonparametric  interval. 
Interval  half-widths  (errors)  are  combined  as  the  square  root  of  the  sum  of 
squares,  even  when  a  Gaussian  variable  is  combined  with  a  non-Gaussian  variable. 
There  is  some  question  about  the  resulting  confidence  level.  (This  same 
question  exists  even  when  combining  the  same  types  of  intervals.)  Also, 
concerning  the  distinction  between  systematic  and  random  uncertainties, 

Rockwell  found  only  one  variable  to  have  significant  systematic  uncertainty  in 
the  EC-135.  That  variable,  threshold  current,  was  corrected  for  its  estimated 
bias  (approximately  12  dB).  Thus,  the  only  uncertainties  combined  in 
constructing  the  final  reliability-confidence  interval  for  the  EC-135  were 
random  uncertainties.  For  a  somewhat  more  detailed  treatment  of  these  and 
other  difficulties  in  the  Rockwell  approach,  see  Ref.  19. 

5.0  A  METHODOLOGY  BASED  ON  PROBABILISTIC  ANALYSIS 

As  indicated  in  the  discussion  of  alternative  vulnerability  assessment 
methodologies,  any  realistic  assessment  must  take  into  consideration  the 
uncertainties  in  the  assessment  variables.  A  method  based  on  a  worst-case 
assessment,  though  it  may  be  practical,  is  not  realistic,  since  it  deals  with 
a  situation  that  generally  has  a  very  low  probability  of  occurring.  The  more 
realistic  approach  is  to  recognize  the  variation  in  the  uncertainties.  A  con¬ 
venient  method  for  describing  this  variation  is  a  probability  distribution. 

Thus,  the  tools  of  probability  should  be  used  in  the  assessment  methodology. 

Two  of  the  methods  described  in  Section  4  use  probability  to  handle  uncertain¬ 
ties,  but  they  inadequately  separate  the  effects  of  random  and  systematic 
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uncertainties,  and  their  methods  for  combining  uncertainties  in  several  vari¬ 
ables  are  suspect. 

A  methodology  that  recognizes  the  variation  in  variable  uncertainties  and 
that  does  not  have  the  deficiencies  mentioned  above  is  based  on  the  use  of 
Monte  Carlo  methods  to  analyze  the  effect  of  uncertainties  in  the  assessment 
variables.  A  flow  diagram  illustrating  such  an  approach  is  given  in  Fig.  5.1. 
This  approach  relies  heavily  on  computer  models  to  describe  the  coupling  (both 
exterior  and  interior)  for  a  system.  Inputs  are  assumed  to  be  environmental 
data  (e.g.,  EMP  electric  field  data  generated  by  EMP  codes),  coupling  models 
with  appropriate  system  parameter  values,  component  susceptibility  data 
(perhaps  developed  from  test  data),  and  finally,  a  system  model  consistent 
with  the  assessment  goal.  Thus,  the  system  model  may  depend  on  whether  the 
aim  is  to  assess  vulnerability,  hardening,  or  survivabil ity  (the  ability  to 
complete  a  specified  mission  when  subject  to  a  given  threat).  Additional 
important  inputs  are  the  probability  distributions  that  describe  the  variation 
in  the  uncertainties  associated  with  each  of  the  assessment  variables. 

Separate  distributions  are  used  for  each  type  of  uncertainty  (random, 
systematic,  and  judgmental). 


FIG.  5.1.  Elements  of  a  probabilistic  approach  for  handling  uncertainties. 
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For  fixed  values  of  each  systematic  (or  judgmental)  uncertainty,  chosen  at 
random  from  the  distribution  of  such  uncertainty,  the  environment  confronting 
a  system  is  simulated  by  randomly  selecting  a  random  uncertainty  for  the 
environmental  variable.  In  propagating  the  environmental  variable  through  the 
coupling  model,  the  tools  of  reliability  theory  are  used  to  determine  the 
probability  of  the  component  surviving  by  comparing  the  input  to  the  component 
with  the  component  failure  threshold.  The  survival  probabilities  for  all  the 

system  components  are  then  combined,  using  the  system  model,  to  determine  the 

probability  of  system  survival.  Iterating  through  this  procedure  and  averaging 
all  the  probabilities  provides  an  estimate  of  the  expected  probability  of 
survival  (or  failure)  for  the  given  systematic  (or  judgmental)  uncertainty. 

This  is  an  estimate  of  the  probability  that  the  system  will  survive  when 
confronted  by  a  threat. 

This  procedure  is  repeated  for  additional  values  of  the  systematic  (or 
judgmental)  uncertainties,  and  thus  a  distribution  of  values  of  the  estimated 
probability  of  survival  is  generated.  The  average  value,  taken  from  this 

distribution,  is  the  point  estimate  of  the  probability  of  survival  for  the 

system.  This  average  is  taken  over  all  possible  variations  of  the  environment 
and  component  susceptibility,  as  well  as  uncertainties  in  modeling,  testing, 
judgment,  etc.  In  addition,  the  distribution  generated  in  this  way  can  be 
used  to  present  a  range  of  values  for  the  probability  of  survival.  Although 
the  discussion  of  this  approach  has  concentrated  on  taking  averages,  it  is 
possible  to  use  other  measures,  for  example,  the  probability  of  survival 
exceeded  in  at  least  a  certain  percentage  (e.g.,  95%)  of  cases  with  respect  to 
the  random  uncertainty.  The  important  thing  to  recognize  is  that  this  approach 
realistically  measures  system  performance  in  the  environments  it  is  likely  to 
encounter,  because  it  accounts  for  both  the  magnitude  of  the  threat  and  the 
frequency  of  its  occurrence. 

One  variation  of  this  approach  has  been  applied  to  two  simple  systems  at 
LLNL.  These  analyses  used  the  computer  program  FAST16  to  sample  the  random 
and  systematic  uncertainties,  and  the  circuit/ systems  computer  program  NET-2 
to  develop  some  of  the  internal  coupling  data.  Both  of  these  programs  have 
shortcomings  (e.g.,  FAST  assumes  a  linear  transfer  function  to  describe 
coupling),  but  their  use  illustrates  the  methodology  described  above.  In  fact, 
the  output  of  this  type  of  assessment  compares  well  with  experimentally  based 
data.  These  results  are  discussed  in  the  next  section. 
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6.0  VALIDATION  EXPERIMENTS 

The  first  validation  experiment  used  EMP  radiation  of  a  monopole  antenna 
with  a  microwave  diode  load.  The  second  used  a  transistor  multivibrator 
circuit,  which  was  driven  by  a  potentially  damaging  electrical  pulse.  Both 
experiments,  though  simple,  had  the  features  necessary  for  validating  the 
probabilistic  approach.  We  obtained  input  data  for  the  FAST  computer  program 
from  the  experiments  and  from  numerical  calculations.  We  used  FAST  to  predict 
the  overall  system  probability  of  failure,  as  a  function  of  the  applied 
environmental  stress. 

6.1  MONOPOLE /DIODE  EXPERIMENT 

We  assembled  a  monopoly  antenna  with  a  diode  load  on  the  LLL  Transient 
Electromagnetic  Range, ^  as  illustrated  in  Fig.  6.1.  This  simple  system 
embodies  all  of  the  ingredients  needed  to  demonstrate  the  application  of  the 
FAST  program  to  assessment.  Oevice  burnout  is  specified  by  diode  fragility 
curves,  the  environment  appears  as  the  incident  electromagnetic  field  (from 
the  monocone  pulse  antenna),  and  the  network  transfer  function  relates  the 
incident  field  level  to  the  energy  collected  by  the  monopole  antenna  and 
delivered  to  the  diode  load. 

The  experiment  provided  simple  systems  tests.  If  the  amplitude  of  the 
5-ns  pulse  generated  by  the  pulser,  radiated  to  the  monopole,  and  delivered  to 
the  diode  load  is  sufficently  large,  the  diode  will  burn  out.  In  each  test, 
only  one  pulse  was  delivered  to  the  diode  load  and  each  diode  load  was  used 
only  once.  At  each  level  of  environmental  stress  (the  incident  electromagnetic 
field),  FAST  predicts  the  probability  of  system  failure.  Therefore,  the 
experiment  was  performed  for  three  different  levels  of  field  intensity,  with  a 
sample  lot  of  26  diodes  in  each  case.  Failure  of  a  diode  was  defined  as  a 
12-fold  increase  in  reverse  leakage  current. 

6.1.1  Fragi 1 ity  Curves 

To  determine  fragility  curves,  it  was  necessary  to  obtain  failure  data 
for  the  1N23B  point-contact  microwave  diode  that  was  applicable  in  the  short- 
pulse  (5-ns)  region.  We  performed  separate  tests  to  obtain  these  data.  Four 
hundred  devices  were  tested  in  the  configuration  illustrated  in  Fig.  6.2.^ 
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The  burnout  criterion  was  based  on  the  distribution  of  leakage  current  of  234 
devices  before  testing.  The  mean  leakage  current  was  7.0  pA,  with  a  sample 
standard  deviation  of  5.93  pA.  The  test  configuration  of  Fig.  6.2  uses  a 


FIG.  6.2.  Arrangement  used  to  obtain  short-pulse  diode  burnout  data  (adapted 
from  Ref.  20) . 
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mercury  pulse  generator  with  adjustable  pulse  amplitude  and  a  5-ns  pulse 
width.  Energy  delivered  to  the  coaxial  line  (in  joules)  is  expressed  as 


where  T  is  the  pulse  width  in  seconds,  is  the  pulse  voltage  (attenuated 

p  P 

by  a  factor  of  10),  and  1Q  is  the  line  impedance  (50  £1) .  The  diode  was 
mounted  into  a  coaxial  fixture  and  probes  CT-1  and  CT-3  were  used  to  monitor 
current  in  the  diode  and  voltage  on  the  line  with  the  diode.  The  attenuator 
diminished  reflected  pulses  between  the  load  and  the  pulse  generator. 

We  performed  the  diode  tests  at  several  levels  to  obtain  estimates  of  the 
fragility  curves  over  severil  percentiles.  Twenty-six  diodes  were  single-pulse 
tested  at  each  voltage  level  (52  were  tested  at  80  V),  and  checked  for  failure. 
A  summary  of  the  results  is  shown  in  Table  6.1. 

Point  and  90%  confidence  interval  estimates  for  the  probability  of  failure, 

Pf,  are  based  on  the  following  formulas: 

Pf  =  number  of  diodes  failing  , 
n 

iPf.v  Pf,u>  *  f Pf  i  ,-64 

where  n  is  the  number  of  diodes  tested.  These  estimates  are  given  in  the  last 
two  columns  of  Table  6.1.  Empirical  cumulative  distribution  functions  based 
on  these  estimates  are  given  in  Fig.  6.3.  The  middle  curve  is  the  best 
estimate  of  the  diode  fragility,  based  on  the  estimates  of  p^.  Figure  6.3 
also  shows  the  lower  and  upper  limits  on  the  fragility  due  to  the  systematic 
uncertainty  of  estimating  it  from  test  data. 


/ 


Pf(l  -  Pf) 


6.1.2  Transfer  Function 

We  obtained  the  transfer  function  that  relates  the  incident  electro¬ 
magnetic  field  level  at  the  monopole  to  the  energy  delivered  to  the  diode 

22 

load,  with  the  help  of  the  computer  program  WT-MBA/LLL1B.  This  program 
permits  the  modeling  of  wire  structures,  such  as  the  monopole,  with  a  series 
of  short  interconnected  segments.  The  numerical  model  of  the  1.13-m  monopole 
over  a  ground  plane  resembles  a  2.26-m  dipole  in  free  space,  with  a  100-ft 
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Probability  of  failure 


TABLE  6.1.  Summary  of  diode  tests. 


90%  confidence 

Estimated 

1 imi ts  for 

Pulse 

Number 

Number 

probabil ity 

probabi 1 ity 

voltage,  Va 

Energy,  J 

tested 

fail ed^ 

of  failure  (pf) 

of  failure 

15 

2.25  x  10“8 

26 

1 

0.038 

(0,  0.104) 

30 

9.0  x  10'8 

26 

4 

0.154 

(0.038,  0.270) 

40 

1.6  x  10‘7 

26 

9 

0.346 

(0.195,  0.497) 

45 

2.025  x  10"7 

26 

16 

0.615 

(0.459,  0.771) 

50 

2.5  x  10'7 

26 

18 

0.692 

(0.544,  0.849) 

60 

3.6  x  10‘7 

26 

19 

0.731 

(0.588,  0.874) 

80 

6.4  x  10'7 

52 

44 

0.827 

(0.738,  0.916) 

100 

1.0  x  10'6 

26 

25 

0.962 

(0.896,  1.0) 

aPulse  voltage  is  voltage 

into  coax 

leading 

to  diode  and  is  equal  to  the 

mercury  pulser  voltage  divided  by  10. 

bDiode  failure  occurs  if  reverse  leakage  current  exceeds  84  pA. 
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load  as  its  center.  Figure  6.4  shows  the  calculated  voltage  across  one  half 
of  the  100-&  load  for  a  1  V/m  electric  field  amplitude,  plane-wave  incidence, 
1-ns  rise  and  fall  times,  and  a  5-ns  pulse  width  (FWHM).  The  cumulative  energy 
delivered  to  the  50-ft  load  is  shown  in  Fig.  6.5  for  the  positive  half  cycles. 
The  asymptotic  value  of  1.35  x  10  J  was  used  in  the  transfer  function  for 
FAST. 

6.1.3  Results 

To  evaluate  the  assessment  methodology,  we  took  two  approaches  to  develop 
data  for  comparison  with  the  probabilistic  estimate  of  system  failure.  One 
source  of  data  was  the  experiment  involving  the  monopole/dipole  network  shown 
in  Fig.  6.1.  The  diode  fixture  and  cable  attached  to  the  monopole  are  the 
same  as  that  used  in  establishing  the  diode  burnout  data.  Three  levels  of 
incident  electric  field,  256  V/m,  372  V/m,  and  460  V/m,  were  used  in  the 
experiment.  At  each  level,  26  diodes  were  tested.  The  results  of  the  tests 
are  summarized  in  Table  6.2. 

A  second  source  of  validation  data  was  an  analytical  computation  of  the 
probability  of  system  failure.  This  analysis  was  based  on  the  assumption  that 
both  the  diode  failure  threshold  and  the  energy  applied  to  the  system  are  log¬ 
normal  random  variables.  This  assumption  is  consistent  with  the  experimental 
data,  and  the  values  of  the  parameters  of  the  probability  distributions  were 
derived  from  these  data.  The  analysis  is  based  on  the  fact  that  the  probabil¬ 
ity  of  system  failure,  p^,  can  be  computed  from  the  relationship 

Pf  =  P(E  >  T) 


=  P  |(ln  E  -  In  T)j>  0  , 

where  E  denotes  the  applied  energy  and  T  denotes  the  failure  threshold.  Since 
both  E  and  T  are  lognormal  random  variables,  the  difference, 

M  -  In  E  -  In  T  , 

is  a  normal  random  variable.  Thus,  the  probability  of  failure  is  the  probabil 
ity  that  W,  with  the  appropriate  mean  and  variance,  is  greater  than  zero. 
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FIG.  6.4.  Calculated  voltage  across  a  50-ft  load  for  a  2.26-m  dipole. 


FIG.  6.5.  Cumulative  energy  into  a  50-fi  load  on  a  1.13-m  monopole 
for  a  5-ns,  1-V/m  incident  plane-wave  pulse. 
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TABLE  6.2.  Measured  failures  for  monopole/diode  experiment. 


Incident 
electric 
Field,  V/m 

Pulser 

voltage 

No. 

of  diodes 
tested 

No. 

of  diodes 
failed 

Estimated 
probability 
of  failure 

80%  confidence 
intervals  for 
probability  of 
failure 

256 

517 

26 

5 

0.192 

(0.093,  0.291) 

372 

752 

26 

15 

0.58 

(0.453,  0.701) 

460 

929 

26 

18 

0.692 

(0.576,  0.808) 

The  results  of  this  probabilistic  analysis  based  on  the  FAST  program  are 
summarized  in  Table  6.3.  The  inputs  into  the  FAST  program  were  the  environ¬ 
ment,  transfer  function,  and  fragility  data  described  earlier.  The  output  of 
the  program  is  the  probability  distribution  for  pf,  the  probability  of  system 
failure.  Selected  percentiles  of  the  output  distribution  are  the  entries  in 
Table  6.3.  Reasonable  point  estimates  of  are  the  50th  percentiles,  0.135, 

0.490  and  0.679  for  256,  372  and  460  V/m  respectively,  of  the  distribution  of 

pr 

A  summary  of  the  comparison  of  the  experimental  and  analytical  results 
with  the  probabilistic  results  are  presented  in  Table  6.4.  In  general  there 
is  good  agreement  between  the  validation  results  and  the  estimate  based  on  the 
probabilistic  analysis  using  FAST.  Of  course,  this  comparison  involves  a  very 
simple  system.  The  experimental  estimate  of  pf  is  highest  at  all  three  elec¬ 
tric  fields,  indicating  a  possible  bias  in  one  or  more  of  the  methods.  Several 
factors  affect  the  comparison: 

t  The  experimental  estimate  is  based  on  a  relatively  small  sample  of  26 
units  (at  each  field  intensity). 

•  The  analytical  approach  assumed  lognormal  distributions  (an  approximation). 

•  In  the  probabilistic  analysis,  all  systematic  uncertainties  were 
considered  negligible  except  those  associated  with  the  fragility  curves 
for  the  diode. 

6.2  MULTIVIBRATOR  EXPERIMENT 


In  the  multivibrator  experiment,  we  used  both  available  analysis  tools 
and  an  existing  component  data  base  in  combination  with  laboratory  tests  for 
the  validation  study.  For  analysis  and  experiment,  a  conventional  two-battery- 
biased,  collector-coupled  monostable  multivibrator  circuit,  using  two  2N918 
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TABLE  6.3.  Percentiles,  Pa,  of  the  probability  distribution  of  pf,  the 
probability  of  system  failure,  at  three  incident  electric  fields. 


Probability 

that  P,  <  P 
f  a 

Percentiles  (P  ) 
a1 

at  256  V/m 

at  372  V/m 

at  460  V/m 

0.01 

0.056 

0.313 

0.513 

0.10 

0.102 

0.388 

0.607 

0.30 

0.118 

0.441 

0.658 

0.50 

0.135 

0.490 

0.679 

0.70 

0.155 

0.528 

0.700 

0.90 

0.217 

0.583 

0.750 

0.99 

0.337 

0.675 

0.838 

TABLE  6.4.  Comparison  of  experimental,  analytical,  and  probabilistic  results. 


Electric  field,  V/m 

Probability  of  failure  (pf) 

Experimental 

Analytical 

Probabilistic  (FAST) 

256 

0.192 

0.172 

0.135 

372 

0.580 

0.460 

0.490 

460 

0.692 

0.645 

0.679 

transistors,  was  contrived.  This  circuit  was  modeled  and  analyzed  with  version 
9.1  of  the  computer  program  NET-2.  Published  failure  data23  on  the  2N918 
were  used  to  set  the  component  fragility.  In  the  laboratory  tests,  the  multi¬ 
vibrator  was  subjected  to  a  stress  environment  of  electrical  pulses,  injected 
through  diodes  into  the  base  of  each  of  the  transistors,  to  verify  the  analytic 
predictions  of  failure  obtained  from  the  NET-2  simulation  results.  The  config¬ 
uration  used  for  the  laboratory  tests  is  shown  in  Fig.  6.6. 
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Monostable  multivibrator  circuit 
(partial  schematic) 


FIG.  6.6.  Test  configuration  for  multivibrator  circuit  burnout  experiment. 


6.2.1  Circuit  Analysis  with  NET-2 

A  preliminary  examination  of  the  multivibrator  circuit  indicated  that 

the  transistors  would  be  the  components  most  susceptible  to  burnout.  Previous 
23 

data  on  the  2N918  show  that  failure  is  likely  for  reverse  voltages  near 
13.5  V  for  the  emitter-base  junction,  for  a  1-ps  pulse  width,  with  failure 
currents  of  0.4  to  0.5  A.  After  some  preliminary  runs  with  NET-2  established 
the  magnitude  of  the  required  burnout  pulse,  Epulse,  we  analyzed  the  circuit 
with  the  Monte  Carlo  option  of  the  code.  A  100-sample  Monte  Carlo  solution 
was  found  for  a  fixed  point  in  ime  {5.75  ps),  where  only  the  parameters 
VBE  (breal<down  voltage),  Rgg,  and  Epu-|se  were  varied.  These  parameters 
are  highly  significant  in  the  failure  predictions,  and  Gaussian  parameter 
distributions  were  used  to  represent  their  variations.  An  average  value  of 
8.7  V  for  Vg£  was  calculated  from  previous  results,  and  the  average  value  of 
Rg£  was  estimated  as  10  Q.  The  3o  points  for  NET-2  were  1.1  V  and  5  SI. 

The  pulser  voltage  was  varied  between  64  and  68  V. 
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Table  6.5  presents  an  example  of  the  output  quantities  calculated  by  NET-2. 
According  to  these  predictions,  failure  is  about  equally  likely  for  the  two 
transistors. 

6.2.2  FAST  Analysis 

Using  the  output  of  NET-2,  we  developed  fragility  curves  for  the  transistors 
(similar  to  the  curves  illustrated  in  Fig.  6.3).  The  uncertainty  limits  were 
based  on  confidence  interval  estimates  of  the  mean.  The  environmental  data  used 
were  the  Ep  i  values  with  a  nominal  voltage  of  65  V.  The  estimate  of  the 
probability  of  system  survival,  ps,  based  on  the  probabilistic  analysis,  is 
0.368. 

6.2.3  Experimental  Results 

Laboratory  tests  were  performed  on  the  multivibrator  circuit,  using  the 
arrangement  shown  in  Fig  6.6.  The  Hewlett-Packard  pulse  generator  was  used 
to  check  the  normal  operation  of  the  monostable  circuit.  Each  time  the  0.5-ys 
pulser  is  actuated,  a  10-ps  pulse  is  observed  in  the  output  from  the  multivi¬ 
brator.  Initial  burnout  tests  were  performed  at  65  V  at  the  output  of  the  10  x 
attenuator  connected  to  the  mercury  pulser.  Only  a  single  burnout  pulse  was 
applied  to  the  circuit.  After  each  pulse,  the  cicuit  was  considered  to  have 
survived  if  it  continued  to  function  normally.  Transistors  T1  and  T2  were 
replaced  after  each  test.  The  replaced  transistors  were  subsequently  checked 


TABLE  6.5.  Breakdown  voltages  across  the  base-emitter  junctions  of  two  tran¬ 
sistors,  calculated  by  NET-2. 


Breakdown  voltage  (Vgg),  V 
Minimum  Average  Maximum  Std  dev 


Transistor 


on  a  curve  tracer  to  determine  which  device  had  burned  out.  Based  on  this 
functional  criterion,  8  out  of  20  circuits  survived;  thus,  the  experimental 

estimate  of  survival  is  ps  =  0.4.  This  agrees  closely  with  the  estimate 
based  on  the  FAST  code,  particularly  since  only  20  units  were  tested 
experimental ly. 

Since  the  fragility  data  were  based  on  an  assumption  of  failure  whenever 
the  beta  gain  factor  of  a  transistor  exceeded  a  10%  degradation,  a  second 
experiment  involving  40  circuits  was  run  using  the  10%  degradation  as  the 
failure  criterion.  At  this  level,  the  circuit  can  still  function;  thus,  an 
estimate  of  the  probability  of  survival  based  on  10%  degradation  is  close  to  a 
lower  bound  of  the  survival  probability.  Among  the  40  circuits  tested,  11 
survived  using  this  criterion;  thus,  the  estimate  of  the  probability  of 
survival  is  p$  =  0.275.  This  figure  is  lower  than  both  the  FAST  estimate 
and  the  estimate  based  on  a  functional  criterion  of  failure.  However,  since 
about  half  of  the  circuits  continued  to  function  after  failure  (using  the  10% 
degradation  criterion),  this  level  of  gain  degradation  is  not  a  realistic 
failure  criterion  for  this  circuit. 

7.0  HARDENING  AND  PROTECTION  OPTIONS 

A  probabilistic  design  methodology  is  a  logical  way  to  approach  vulner¬ 
ability  assessment  analysis  and  hardness  specification.  There  are  different 
options  to  consider  when  one  is  faced  with  assessing  and  hardening  systems  in 
quite  different  stages  of  development.  The  emphasis  here  will  be  more  on 
assessment  for  hardening  when  the  system  is  already  developed  or  fielded.  The 
hardening  options  will  necessarily  be  tied  closely  to  the  results  of  assessment 
and  to  the  penalties  that  would  be  incurred  by  a  redesign  or  retrofit  for 
hardening  purposes.  Actual  hardening  options  for  existing  systems  may  be  quite 
limited.  In  the  extreme,  an  operational  change  may  be  necessary.  A  new  design 
would  be  most  flexible  in  terms  of  system  engineering  studies  for  hardening 
options.  In  all  cases,  however,  it  is  a  question  of  choosing  the  appropriate 
set  of  hardening  options  when  faced  with  given  operating  constraints. 

There  are  several  types  of  protection  methods  available,  one  or  all  of 
which  may  be  used  in  a  particular  protection  option.  A  system  protection 
design  approach,  referred  to  as  "apportionment  of  protection,"  is  often  used. 


The  idea  is  to  distribute  the  protection  so  as  to  avoid  a  heavy  reliance  on  a 
single  protection  method,  such  as  a  shield.  A  well-balanced  apportionment 
scheme  would  appear  to  offer  the  least  risk  from  an  uncertainties  viewpoint, 
as  significant  factors  of  safety  could  overcome  the  variations  in  each  method 
used  in  the  apportionment  scheme.  If  uncertainties  could  be  quantified  suffi¬ 
ciently  and  if  the  system  protection  and  environment  interaction  were  suffi¬ 
ciently  well  understood,  then  the  probabilistic  approach  could  be  used  to 
overcome  the  heavy  reliance  on  safety  factors  in  protection. 

8.0  SUMMARY 

In  this  paper,  we  examined  the  general  problem  of  uncertainties  and  their 
impact  on  high-altitude  EMP  vulnerability  assessment  of  military  systems. 
Typical  uncertainties  in  coupling  and  susceptibility  have  been  presented. 
Furthermore,  the  main  methodologies  used  in  vulnerability  assessment  have  been 
reviewed  and  their  respective  handling  of  the  uncertainties  discussed.  One 
such  methodology,  based  on  probabilistic  techniques,  has  been  partially  vali¬ 
dated  at  LLNL  with  two  simple  system  tests,  and  the  results  were  discussed.  In 
addition,  we  discussed  statistical  test  techniques  used  to  obtain  the  necessary 
data,  to  formulate  the  vulnerability  issue  in  a  probabilistic  framework. 

Coupling  uncertainties  can  be  quite  high.  For  example,  uncertainties  in 
test  data  for  internal  cable  currents  of  aircraft  can  be  as  high  as  +20  dB  for 
tests  in  a  full-scale  free-field  simulator.  This  includes  measurement,  extra¬ 
polation,  and  intersystem  and  intrasystem  uncertainties,  all  combined  as  the 
square  root  of  the  sum  of  squares.  The  coupling  uncertainty  will  be  even 
higher  if  analytical  techniques  are  used. 

Inherent  variability  in  the  threshold  failure  levels  of  components  when 
subjected  to  certain  types  of  electromagnetic  environments  is  a  large  source 
of  uncertainty  in  doing  a  subsystem  assessment.  Frequently,  more  closely  con¬ 
trolled  features  of  a  circuit  that  surrounds  a  component  cause  less  variation 
in  the  susceptibility  at  a  set  of  circuit  interface  terminals  than  would  be 
observed  in  the  component  alone.  Component  parts  may  have  one  or  two  orders 
of  magnitude  of  uncertainty  in  failure  levels  unless  subject  to  parts  control 
procedures.  Past  programs  have  shown  that  calculated  threshold  levels  consti¬ 
tute  a  high-reliability  lower  bound  on  true  thresholds  as  determined  by  tests. 
Failure  test  data  also  indicate  margins  of  the  order  of  +13  dB  for  aircraft- 
type  equipment. 
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There  is  considerable  diversity  in  methodologies  applied  to  assessing  the 
vulnerabilities  of  systems  to  EMPs.  This  is  particularly  true  of  how  uncer¬ 
tainties  in  the  assessment  variables  are  treated,  especially  how  uncertainties 
are  combined  for  the  ultimate  evaluation  of  margins  of  safety  and  probabilities 
of  survival.  One  method  based  on  probabilistic  analysis  offers  an  efficient 
way  of  combining  uncertainties  with  a  minimum  of  assumptions.  Thus,  many  of 
the  shortcomings  of  the  more  analytical  methods  are  avoided.  In  this  study, 
estimates  (based  on  probabilistic  analysis)  of  the  probabilities  of  survival 
for  two  simple  systems  compared  favorably  to  experimental  results.  This 
indicates  that  an  assessment  method  based  on  probabilistic  analysis  has  poten¬ 
tial  for  effectively  accommodating  uncertainties  in  the  assessment  variables. 

As  far  as  uncertainty  reduction  is  concerned,  reduction  in  certain  areas 
seems  much  more  plausible  than  in  others.  In  coupling,  reduction  of  measure¬ 
ment  uncertainties  depends  largely  on  novel  simulator  and  probe  technology. 

The  largest  payoff,  however,  will  be  improved  extrapolation  techniques, 
improved  cable  layout  control  to  minimize  intersystem  differences,  and  the 
conducting  of  tests  in  the  power-on  mode.  In  the  susceptibility  domain,  with 
strict  control  of  components  and  circuits  configuration,  the  uncertainties  can 
perhaps  be  reduced  to  +6  dB. 
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